The management of rental apartments today rarely runs through paper files and personal folders. Applications for an apartment are submitted via online forms, creditworthiness is queried at the push of a button from an external provider, defect reports land in a ticket system, and electricity consumption is recorded to the minute by a smart meter.
Who actually processes the data?
In the past, it was usually clear: the landlord or the management collected and used the data of prospective tenants and tenants. Today, other parties are often involved – software and cloud providers, operators of tenant portals, and credit rating services. What matters is not the designation in the contract, but who actually determines for what purpose and how data is processed. Depending on how a software provider substantively shapes the selection of prospective tenants, it may even be (co-)responsible under data protection law.
From application to move-in
Even at the application form stage, the question arises as to which information is permissible. As a rule, name, contact details, or approximate income may be collected; it becomes more delicate with questions about marital status, nationality, or health, which are generally irrelevant to the allocation of housing. The practice of researching applicants via social media profiles is also only permissible within narrow limits under data protection law, because such profiles often reveal little about suitability as a tenant, but may disclose particularly protected information.
During the tenancy
Even after the conclusion of the contract, digital systems accompany the tenancy: tenant portals, electronic dossiers, ticket systems for defect reports, and smart meters for electricity and water. All these systems must remain purpose-bound – data from the tenant dossier, for example, must not simply be reused for marketing purposes. Particular caution is required with internal notes on individual tenancies: over time, these can create a veritable «tenant profile», which is subject to particularly strict requirements regarding objectivity and accuracy.
What this means in practice
For landlords and property managers, the following applies: digitalization must not simply run "alongside" but should be organized deliberately and with clear responsibilities – from well-thought-out contracts with software and cloud providers to a deletion concept for data that is no longer needed. Violations of the data protection law can be severely sanctioned.
The complete expert article by David Hug was published in: mietrechtspraxis (mp) 2/2026, pp. 95–116.
28.08.2026
